[Ubuntu 24.04][Install] uninstall --all-gateway-ports refuses cleanup for gateways onboarded with a custom NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR

## Description

`nemoclaw uninstall --all-gateway-ports --yes` iterates every registered gateway port independently and backs up each sandbox successfully, but the final removal step refuses to proceed for any gateway that was onboarded with a custom `NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR` override. Onboard's own preflight error message recommends this exact env var combination to run multiple concurrent-driver gateways on one host, but `--all-gateway-ports` has no mechanism to recover the state-dir override per gateway at cleanup time.

Platform scope: Reproduced on Ubuntu 24.04 only; other platforms not tested.
Regression: Unknown — earlier versions not tested.

## Environment

```text
OS: Ubuntu 24.04
Architecture: x86_64
Node.js: v22.23.0
npm: 10.9.8
Docker: 29.7.2
OpenShell CLI: 0.0.106
NemoClaw: 0.0.116
OpenClaw: 2026.7.1
```

## Steps to Reproduce

1. Onboard three sandboxes on three separate gateway ports, at least one of them using `NEMOCLAW_GATEWAY_PORT={port}` together with `NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR={custom-path}` (the pattern NemoClaw's own onboard preflight suggests for running concurrent driver-conflicting gateways).
2. Run:
```bash
nemoclaw uninstall --all-gateway-ports --yes
```
3. Observe the per-gateway pass for the custom-state-dir gateway.

## Expected Result

Each gateway pass, including ones onboarded with a custom state-dir override, completes cleanup successfully (or clearly explains how to supply the override so cleanup can complete), matching the pattern onboard itself recommends for concurrent gateways.

## Actual Result

```text
Backing up current sandbox state before uninstall...
Backing up '{sandbox}'...
✓ {sandbox}: 11 dirs, 1 files → {backup-path}

Pre-uninstall backup: 1 backed up, 0 failed, 0 skipped
Backups stored in: {backup-path}
Refusing scoped gateway cleanup because its sandbox namespace cannot be proven.
If onboarding used a gateway state override, rerun with NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR= set to its original resolved directory.
Uninstall completed with errors. Some state may remain on disk; see warnings above.
Uninstall failed for gateway port {port}; its resources may remain on disk.
```

## Logs

Not captured beyond the console output shown above.

## Related Bugs

Related but distinct: #10544 (uninstall refuses to remove a gateway left by an interrupted onboard) — different root cause (interrupted onboard vs. custom state-dir override), same general "scoped cleanup refuses without provable namespace" symptom family.